374f5dc5f004869401e7eca5c00a584da4184e7a59a06cbefb4174efecb4f8ac

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5001f3bd0c261eb6935e95faa7f9cbfa.exe
Size

2.7MB
MD5

5001f3bd0c261eb6935e95faa7f9cbfa
SHA1

80f75f0c460d84707d160a6e36960f83366b757b
SHA256

374f5dc5f004869401e7eca5c00a584da4184e7a59a06cbefb4174efecb4f8ac
SHA512

9fa9590abf50fa1c5ab14dc9e9733aa8d14d4b20eb0fd577cd3686dcae1d60a95914f6924eda13e8dc1ec28d17bd1d5f07fc1bd600122a5588366d2077aff4b1
SSDEEP

49152:KkkpKsRF6uVkkOAUnVQYc9MCMdzF0cIkflaMdVfmxNZxqPozneYg:svRp2hvnVvc9MCMdBVzfmxNqAzn

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2864	5001f3bd0c261eb6935e95faa7f9cbfa.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	5001f3bd0c261eb6935e95faa7f9cbfa.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122dc-14.dat	upx
behavioral1/files/0x000b0000000122dc-11.dat	upx
behavioral1/memory/1696-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe
2864	5001f3bd0c261eb6935e95faa7f9cbfa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2864	1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe	15
PID 1696 wrote to memory of 2864	1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe	15
PID 1696 wrote to memory of 2864	1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe	15
PID 1696 wrote to memory of 2864	1696	5001f3bd0c261eb6935e95faa7f9cbfa.exe	15

C:\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe
"C:\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe
  C:\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe

Filesize
45KB

MD5
b16902329a36f53b13fa63a3a57a599a

SHA1
d73e9267ae0e5eb77bacafd39034cdb529afbe3e

SHA256
1d2b9336d30cb125c30047b496d45a47d76ccb475c7a39145366e77f97089573

SHA512
3fe04526e110774bdaf22c306c1b1b1a751bd015efc8cda63952cc1401d08d32745021ce2d6e5205a5d98fa347c5fda8692443f00ba2dc485f9ef102fdbea26e

Download Submit
\Users\Admin\AppData\Local\Temp\5001f3bd0c261eb6935e95faa7f9cbfa.exe

Filesize
78KB

MD5
87e7839594b752ba18f5fa576bfd0bce

SHA1
48f2924c681754e8416273ce7f2cfd47be89daad

SHA256
9c04c51928b97871b688526ace9a371495a3cbfd509f292302536ee948862c7e

SHA512
9bea1f6baf650ba9bb085f93670fe49937a550a98214598d3b141873382c54c91369fb3ba95a646f1eaf739297ad5ae3786683ac221eb31872fd78e6bbd0c97a

Download Submit
memory/1696-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/1696-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1696-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1696-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2864-17-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/2864-19-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2864-16-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2864-25-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download